CVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversi...
Original description
The description as published by the source.
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
Affected packages
Bitnami
ruby-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.10"},{"introduced":"2.7.0"},{"fixed":"2.7.6"},{"introduced":"3.0.0"},{"fixed":"3.0.4"},{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]
Bitnami
ruby
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.10"},{"introduced":"2.7.0"},{"fixed":"2.7.6"},{"introduced":"3.0.0"},{"fixed":"3.0.4"},{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-28739 ruby Fixed in: 2.7.6-r0
- Debian DEBIAN-CVE-2022-28739 ruby2.7 Fixed in: 2.7.4-1+deb11u2
References
- advisory seclists.org
- advisory hackerone.com
- advisory security-tracker.debian.org
- advisory security.netapp.com
- advisory support.apple.com
- advisory support.apple.com
- advisory support.apple.com
- advisory ruby-lang.org
- web seclists.org
- web seclists.org
- web seclists.org
- web seclists.org
- web lists.debian.org
- web security.gentoo.org
- web nvd.nist.gov
- web lists.debian.org